Security Risks in Tool-Enabled AI Agents: Systematic Analysis Argues Deployment Design Matters More Than Model Defenses

arXiv (IEEE COMPSAC 2026)·low signal

An extended preprint accepted at IEEE COMPSAC 2026 (arXiv:2605.09721) presents a structured analysis of security risks in cloud-hosted AI agents, introducing a taxonomy of risk categories covering tool authorization, data leakage, and privilege escalation. The paper's key finding: many agent security risks are architectural rather than exploit-driven — deployment design choices (how tools are registered, how permissions propagate, how sandboxes are configured) are as important as model-level defenses. This reinforces the 'agent security is a systems problem' thesis from a complementary empirical angle.